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IN THE CLAIMS 

Amended claims follow: 

1 . (Currently Amended) A computer program produc t embodied on a tangible 
computer readable medium comprising a computer program operable to control a 
computer to detect a known computer program within a packed computer file, said 
packed computer file being unpacked upon execution, said contputer program 
comprising: 

resource data reading logic for reading resource data \rtthin said packed computer 
file, said resource data specifying ptogram resource items used by said known computer 
progranj and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

resource data comparing logic for generating characteristics of said resource data 
and for comparing said characteristics of said resource data with characteristics of 
[[resource data of said]] known computer progra m resource data and for detecting a 
match with said known computer program indicative of said packed computer file 
containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with [[fingerprint data of said]] 
known computer progra m fingerprint data: 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data; 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data; 

wherein said fingermint data includes a location within said resource data of an 
entry specifying a program resource item having a largest size . 

2, (Original) A computer program product as claimed in claim 1, wherein said 
known computer program is one of: 

a Trojan computer program; and 
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a wonn computer program. 

3. (Original) A computer program product as claimed in claim 1 , wherein said 
resource data comparing logic is operable to compare said resource data with 
characteristics of a plurality of known computer programs to detect if said packed 
computer program contains one of said plurality of known computer programs. 

4. (Cancelled) 

5. (Original) A computer program product as claimed in claim 1, wherein said 
program resource items used by said knoAVn computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data, 

6. (Original) A computer program product as claimed in claim 1, wherein said 
resource data specifies for each resource item a storage location of said resource item. 

7. (Original) A computer program product as claimed in claim 6, wherein said 
storage location of said resource item is specified as an relative offset value. 

8. (Original) A computer program product as claimed in claim 1, wherein said 
resource data specifies for each resource item a size of said resoi^rce item. 

9. (Previously Presented) A computer program product as claimed in claim 1, 
wherein said fingerprint data includes a checksum value calculated in dependence upon 
one or more of: 
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a number of program resource items specified beneath each node within 
hierarchically arranged resource dat^ 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

10. (Cancelled) 

11. (excelled) 

12. (Previously Presented) A computer program product as claimed in claim 1, 
wherein said fingerprint data includes timestamp data indicative of a time of compilation 
of said known computer program. 

13. (Cancelled) 

14. (Original) A computer program product as claimed in claim 9, vrfierein said 
checksum value is rotated between each item being added into said checksum. 

15. (Original) A computer program product as claimed in claim 1, wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 

16. (Original) A computer program product as claimed in claim 1, wherein said 
packed computer file is a Win32 PE file. 

17. (Currently Amended) A computer program produc t embodied on a tangible 
computer readable medium comprising a computer program operable to control a 
computer to generate data for detecting a known computer program within a packed 
computer file, said packed computer file being unpacked upon execution, said computer 
program comprising: 
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resource data reading logic for reading tesource data within said packed computer 
fil&i said resource data specifying program resovirce items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algoiithm is used by said packed computer file; and 

characteristic data generating logic for generating characteristic data associated 
with said resource data for comparison with characteristic data of [[resource data of said]] 
known computer urogra m resource data to detect a match with said known computer 
program indicative of said packed computer file containing said known computer 
program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with [[fingerprint data of said]] 
known computer progra m fingerprint data: 

\*erein said fingerprint data includes a number of program resource items 
specified within said resource data; 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint dats^ 

wherein said fingerprint data includjes a location within said resource data of an 
entry specifying a program resource item having a largest size . 

1 8. (Original) A computer program product as claimed in claim 17, wherein said 
known computer program is one of: 

a Trojan computer program; and 
a worm computes: program. 

19. (Previously Presented) A computer program product as claimed in claim 17, 
wherein said characteristic data generating logic is operable to generate characteristic 
data from a plurality of known computer programs to enable detection of any of said 
plurality of known computer programs within said packed computer program. 

20. (Cancelled) 
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21 . (Original) A computer program product as claimed in claim 17, wherein said 
program resource items used by said known computer program include one or more o£ 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

22. (Original) A computer program product as claimed in claim 17, v^dierein said 
resource data specifies for each resource item a storage location of said resource item. 

23. (Original) A computer program product as claimed in claim 22, wherein said 
storage location of said resource item is specified as an relative offset value. 

24. (Original) A computer program product as claimed in claim 17, wherein said 
resource data specifies for each resource item a size of said resource item. 

25. (Previously Presented) A computer program product as claimed in claim 17, 
wherein said fingerprint data includes a checksum value calculated in dependence upon 
one or more of; 

a number of program r^ource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items vrithin said resource data; 

and 

sizes of program resource items within said resource data, 

26. (Cancelled) 

27. (Cancelled) 
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28. (Previously Presented) A computer program product as claimed in claim 17, 
wherein said fingerprint data includes timestamp data indicative of a time of compUation 
of said known computer program. 



29. (Cancelled) 

30. (Original) A computer program product as claimed in claim 25, wherein said 
checksum value is rotated between each item being added into said checksum. 

31. (Original) A computer program product as claimed in claim 17, wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 

32. (Original) A computer program product as claimed in claim 17, wherein said 
packed computer file is a Win32 PE file. 

33. (Currently Amended) A method of controlling a computer to detect a known 
computer program within a packed computet file, said packed computer file being 
unpacked upon execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon \^duch unpackmg algorithm is 
used by said packed computer file; and 

generating characteristics of said resource data and comparing said characteristics 
of said resource data with characteristics of [[resource data of said ]]known computer 
progra m resource data and detecting a match with characteristics of said Icnown computer 
program indicative of said packed computer file containing said known computer 
program; 

wherein said resource data of said packed computer file is processed to generate 
fingeiprint data and to compare said fingerprint data with [[fingerprint data of said 
]]known computer progra m fingerprint data: 
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wherein said fiugerpjint data includes a number of program resource items 
specified within said resource data; 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data; 

wherein said fingerprint data includes a location within said resource data of an 
entry specifying a program resource item havi ng a largest size. 

34. (Original) A method as claimed in claim 33^ wherein said known computer 
program is one of; 

a Trojan computer program; and 
a worm computer program. 

35. (Original) A method as clamed in claim 33, wherein said step of comparing 
compares said resource data with characteristics of a plurality of known computer 
programs to detect if said packed computer program contains one of said plurality of 
known computer programs, 

36. (Cancelled) 

37. (Original) A method as claimed in claim 33, wherein said program resource 
items used by said known computer program include one or more of; 

icon data; 
striagdata; 
dialog data; 
bitmap data; 
menu data; and 
langtiage data. 

38. (Original) A mefthod as claimed in claim 33, wherein said resource data 
specifies for each resource item a storage location of said resource item. 
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39. (Original) A method as claimed in claim 38, wherein said storage location o) 
said resource item is specified as an relative offset value. 

40. (Original) A method as claimed in claim 33, wherein said resource data 
specifies for each resource item a size of said resource item. 

41 . (Previously Presented) A method as claimed in claim 33, wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

strmg names associated wilh program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 



42. (Cancelled) 

43. (Cancelled) 

44. (Previously Presented) A method as claimed in claim 33, wherein 
fingerprint data includes timestamp data indicative of a time of compilation o 
known computer program. 



45. (Cancelled) 

46. (Original) A method as claimed in claim 41 , wherein said checksum value ii 
rotated between each item being added into said checksum. 

47. (Original) A method as claimed m claim 33. wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 
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48. (Original) A method as claimed in claim 33, wherein said packed computer 
file is a Win32 PEfile. 

49. (Currently Amended) A method of controlling a computer to generate data for 
detecting a knovvn computer program within a packed computer file, said packed 
computer file being unpacked upon execution, said method comprising the steps of: 

reading resource data ^thin said packed computer file, said resource data 
speciiying program resource items used by said Icnown computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file; and 

generating characteristic data associated with said resource data for comparison 
with characteristic data of [[resource data of said ]]known computer program resource 
data and detecting a match with said fcaown computer program indicative of said packed 
computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with [[fingerprint data of said 
]]known computer progra m fingerprint data : 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data; 

wherein said fmgerprint data includes a flag indicating which data is included 
within said fingerprint data; 

wherein said fingerprint data includes a location within said r esource data of an 
entry specifying a program resource item having a laigest size, 

50. (Original) A method as clsdmed in claim 49, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 
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51. (Previously Presented) A method as cltdjned in claim 49, wherein said step of 
generating generates characteristic data fi:om a plurality of known computer programs to 
enable detection of any of said plurality of known computer programs within said packed 
computer program. 

52. (Cancelled) 

53. (Original) A method as claimed in claim 49, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog dstai 
bitmap data; 
menu data; and 
language data. 

54. (Original) A method as claimed in claim 49, wherein said resource data 
specifies fbr each resource item a storage location of said resource item. 

55. (Original) A method as claimed in claim 54, wherein said storage location of 
said resource item is specified as an relative offset value. 

56. (Original) A method as claimed in claim 49, vslierein said resource data 
specifies fox each resource item a size of said resource item. 

57. (Previously Presented) A method as claimed in claim 49, wherein said 
fingerprint data includes a diecksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 
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string names associated vdth program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 
5S. (Cancelled) 

59. (Cancelled) 

60. (Previously Presented) A method as claimed in claim 49, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

61. (Cancelled) 

62. (Original) A method as claimed in claim 57. wherein said checksum value is 
rotated between each item being added into said checksum. 

63. (Original) A method as claimed in claim 49, wherein said padced computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

64. (Original) A method as claimed in claim 49, wherein said packed computer 
file is a Win32 PE file. 

65. (Currently Amended) Apparatus for detecting a known computer program 
within a packed computer file, said packed computer file being unpacked upon execution, 
said apparatus comprising: 

a resource data reader for reading resource data within said packed computer file, 
said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system wi&out dependence upon which 
unpacking algorithm is used by said packed computer file; and 
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a resource data compaiator for generating characteristics of said resource data and 
for comparing said characteristics of said resource data with characteristics of [[resource 
data of said ]]knowt computer program jssowce data for detecting a match with said 
known computer program indicative of said packed computer file containing said known 
computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with [[fmgeiprint data of said 
]]known computea: pmgram^ngetprint data; 

■wherein said fingerprint data includes a number of program resource items 
specified within said resource data; 

wherein said fingerprint data includes a flag indicating which daU is included 

within said fingerprint data; 

wherein i^d fingerprint data includ e s a location within said resQTtfge data of an 

entry speoifsang a proeram resource item having a largest size. 

66. (Original) Apparatus as claimed in claim 65, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

67. (Previously Presented) Apparatus as claimed in claim 65, wherein said 
resource data comparator is operable to compare said resource data with characteristics of 
a plurality of known computer programs to detect if said packed computer program 
contains one of said plurality of known computer programs. 



68. (Cancelled) 

69. (Original) Apparatus as claimed in claim 65, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
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dialog data; 
bitmap data; 
menu data; and 
language data. 

70. (Original) Apparatus as claimed in claim 65, wherein said resource data 
specifies for each resource item a storage location of said resource item. 

71 . (Original) Apparatus as claimed in claim 70, wherein said storage location of 
said resource item is specified as an relative ofEset value. 

72. (Original) Apparatus as claimed in claim 65, wherein said resource data 
specifies for each resource item a size of said resource item, 

73. (Previously Presented) Apparatus as claimed in claim 65, wherein said 
fingerprint data mcludes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 

hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

74. (Cancelled) 

75. (Cancelled) 

76. (Previously Presented) Apparatus as claimed in claim 65, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known compirter program. 
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77. (CanceUed) 

78. (Original) Apparatus as claimed in claim 73, wherein said checksum value is 
rotated betweea each item being addfed into said checksum. 

79. (Original) Apparatus as claimed in claim 65, wherein said packed oompxtter 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

80. (Original) Apparatus as claimed in claim 65> wherein said packed computer 
file is a Win32 PE file. 

81 . (Currently Amended) Apparatus for generating data for detecting a known 
computer program within a packed computer file, said packed computer file being 
unpacked upon execution, said apparatus comprising: 

a resource data reader for reading resource data within said packed computer file, 
said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

a characteristic data generator for generating characteristic data associated with 
said resource data for comparison with characteristic data of [[resource data of said 
]]known computer progra m resource data and for detecting a mateh with said known 
computer program indicative of said packed computer file containing said known 
computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with [[fingerprint data of said 
]]known computer progra m fmgerprint data ; 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data; 

wherem said fmgeiprint data includes a flag indicating wijich data is included 
within said fingerprint data; 
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^^^A fi. f>.mn.t. data inol nHrs n location ydHiiii s^id rP^nTce q^ta of an 
anfry ypecifyir r « pnpram Te.^Qurcfe item hflvinp ft tSffRfcst size. 

82. (Origmal) Apparatus as claimed in claim 81, wherein said known computer 

program is one of: 

a Trojan computer program; and 
a worm computer program. 

83. (Previously Presented) Apparatus as claimed in claim 81 , wherein said 
characteristic data generator is operable to generate characteristic data from a pluraUty of 
toown computer programs to enable detection of any of said plurality of known 
computer programs within said packed computer program. 

84. (Cancelled) 

85. (Original) Apparatus as claimed in claim 81, wherein said program resource 
items used by said known computer program mclude one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

86. (Original) Apparatus as claimed in claim 81, wherein said resource data 
specifies for each resource item a storage location of said resource item. 

87. (Origmal) Apparatus as claimed in claim 86. wherein said storage location of 
said resource item is specified as an relative offset value. 
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88. (Original) Apparatus as claimed in claim 81 , wherein said resource data 
specifies for each resource item a size of said resource item. 

89. (Previously Presented) Apparatus as claimed in claim 81, wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items witiim said resource data; 

and 

sizes of program resource items within said resource data, 

90. (Cancelled) 

91. (Cancelled) 

92. (Previously Presented) Apparatus as claimed in claim 81, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program, 

93. (Cancelled) 

94. (Original) Apparatus as claimed in claim 89, wherein said checksum value is 
rotated between each item being added iftto said checksum. 

95. (Original) Apparatus as claimed in claim 81 > wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program, 

96. (Original) Apparatus as claimed in claim 81, wherein said packed computer 
file is a Win32 PE file. 
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97. (New) A computer program product as claimed in claim 1, wherein said 
fingerprint data includes a checksum value calculated in dependence upon: 

a number of program resouice items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within s^d resource data. 

98. (New) A computer program product as claimed in claim 14, wherein said 
checksum value is rotated 1 bit to the left. 
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